Changeset 1201 for trunk/RevCommentPlugin/data/System/WebRssBaseWC.txt

Timestamp:

12/07/08 17:13:55 (3 years ago)

Author:

KennethLavrsen

Message:

Item375: Eliminate use of URLPARAM in docs so it becomes an XSS trap
Done with the System web topics now

File:

• trunk/RevCommentPlugin/data/System/WebRssBaseWC.txt (modified) (2 diffs)

trunk/RevCommentPlugin/data/System/WebRssBaseWC.txt

@@ -50 +50 @@
   <items>
     <rdf:Seq>
-%SEARCH{"%URLPARAM{"search" default=".*" }%" web="%URLPARAM{"web" default="%INCLUDINGWEB%" }%" excludetopic="%URLPARAM{"excludetopic" default="WebStatistics" }%" type="%URLPARAM{"type" default="regex" }%" nosearch="on" order="modified" reverse="on" nototal="on" limit="%URLPARAM{"limit" default="16" }%" scope="%URLPARAM{"scope" default="text" }%" casesensitive="%URLPARAM{"casesensitive" default="on" }%" date="%URLPARAM{"date" default="" }%" format="<item rdf:about=\"%SCRIPTURL{"view"}%/$web/$topic\">$n  <title>$topic</title>$n  <link>%SCRIPTURL{"view"}%/$web/$topic</link>$n <description>%REVCOMMENT[rev=''$rev'' web=''$web'' topic=''$topic'' pre=''ChangeLog: '' delimiter='' -- '' post='''']%</description>$n  <dc:date>$isodate</dc:date>$n  <dc:contributor>$n    <rdf:Description link=\"%SCRIPTURL{"view"}%?topic=$wikiusername\">$n      <rdf:value>$username</rdf:value>$n    </rdf:Description>$n  </dc:contributor>$n</item>"}%
+%SEARCH{"%URLPARAM{"search" encode="quote" default=".*" }%" web="%URLPARAM{"web" encode="quote" default="%INCLUDINGWEB%" }%" excludetopic="%URLPARAM{"excludetopic" encode="quote" default="WebStatistics" }%" type="%URLPARAM{"type" encode="quote" default="regex" }%" nosearch="on" order="modified" reverse="on" nototal="on" limit="%URLPARAM{"limit" encode="quote" default="16" }%" scope="%URLPARAM{"scope" encode="quote" default="text" }%" casesensitive="%URLPARAM{"casesensitive" encode="quote" default="on" }%" date="%URLPARAM{"date" encode="quote" default="" }%" format="<item rdf:about=\"%SCRIPTURL{"view"}%/$web/$topic\">$n  <title>$topic</title>$n  <link>%SCRIPTURL{"view"}%/$web/$topic</link>$n <description>%REVCOMMENT[rev=''$rev'' web=''$web'' topic=''$topic'' pre=''ChangeLog: '' delimiter='' -- '' post='''']%</description>$n  <dc:date>$isodate</dc:date>$n  <dc:contributor>$n    <rdf:Description link=\"%SCRIPTURL{"view"}%?topic=$wikiusername\">$n      <rdf:value>$username</rdf:value>$n    </rdf:Description>$n  </dc:contributor>$n</item>"}%
     </rdf:Seq>
   </items>
@@ -59 +59 @@
   <url>%WIKILOGOIMG%</url>
 </image>
-%SEARCH{"%URLPARAM{"search" default=".*" }%" web="%URLPARAM{"web" default="%INCLUDINGWEB%" }%" excludetopic="%URLPARAM{"excludetopic" default="WebStatistics" }%" type="%URLPARAM{"type" default="regex" }%" nosearch="on" order="modified" reverse="on" nototal="on" limit="%URLPARAM{"limit" default="16" }%" scope="%URLPARAM{"scope" default="text" }%" casesensitive="%URLPARAM{"casesensitive" default="on" }%" date="%URLPARAM{"date" default="" }%" format="<item rdf:about=\"%SCRIPTURL{"view"}%/$web/$topic\">$n  <title>$topic</title>$n  <link>%SCRIPTURL{"view"}%/$web/$topic</link>$n  <description>$summary (last changed by <nop>$wikiname)</description>$n  <dc:date>$isodate</dc:date>$n  <dc:contributor>$n    <rdf:Description link=\"%SCRIPTURL{"view"}%?topic=$wikiusername\">$n      <rdf:value>$username</rdf:value>$n    </rdf:Description>$n  </dc:contributor>$n</item>"}%
+%SEARCH{"%URLPARAM{"search" default=".*" }%" web="%URLPARAM{"web" encode="quote" default="%INCLUDINGWEB%" }%" excludetopic="%URLPARAM{"excludetopic" encode="quote" default="WebStatistics" }%" type="%URLPARAM{"type" encode="quote" default="regex" }%" nosearch="on" order="modified" reverse="on" nototal="on" limit="%URLPARAM{"limit" encode="quote" default="16" }%" scope="%URLPARAM{"scope" encode="quote" default="text" }%" casesensitive="%URLPARAM{"casesensitive" encode="quote" default="on" }%" date="%URLPARAM{"date" encode="quote" default="" }%" format="<item rdf:about=\"%SCRIPTURL{"view"}%/$web/$topic\">$n  <title>$topic</title>$n  <link>%SCRIPTURL{"view"}%/$web/$topic</link>$n  <description>$summary (last changed by <nop>$wikiname)</description>$n  <dc:date>$isodate</dc:date>$n  <dc:contributor>$n    <rdf:Description link=\"%SCRIPTURL{"view"}%?topic=$wikiusername\">$n      <rdf:value>$username</rdf:value>$n    </rdf:Description>$n  </dc:contributor>$n</item>"}%
 %STOPINCLUDE%
 </verbatim>